--- title: Abnormal Security slug: connectors/abnormal-security docTags: createdAt: 2026-06-09T16:30:03.708Z --- The Abnormal Security connector enables automated interaction with the Abnormal Security platform, facilitating threat detection, case management, and incident analysis. Abnormal Security offers a cutting-edge email security platform that leverages behavioral data science to identify and block modern email attacks. This connector enables Swimlane Turbine users to automate the retrieval and management of threat intelligence, case details, and email security incidents directly within the Swimlane ecosystem. By integrating with Abnormal Security, users can streamline their security operations, enhance incident response, and leverage detailed threat insights to protect against sophisticated email-based threats. ### Limitations None to date. ### Supported Versions This Abnormal Security Connector uses the latest Version API. ## Prerequisites Before utilizing the Abnormal Security connector for Swimlane Turbine, ensure you have the following prerequisites: - HTTP Bearer Authentication with the following parameters: - URL: Endpoint for the Abnormal Security API - Authentication Token: Secure token used for authenticating API requests ## Authentication Methods The Abnormal Security HTTP Bearer Authentication connector uses the HTTP Bearer Authentication method to connect to the Abnormal Security API. The following are required to set up the asset: 1. **Token**: The Token generated from Abnormal Security HTTP Bearer Authentication. 2. **URL**: The URL endpoint for the Abnormal Security HTTP Bearer Authentication API. ## Capabilities - Abuse Campaigns List - Campaign Details - Case Action Status - Case Analysis - Case Details - Case Management - Detection 360 Reports - Download a Message in EML Format - Download the Attachment in an Email as a File - Employee Genome Analysis - Employee Information - Get Attachment - Get Details of the Remediation History - List Vendors - Non-analyzed Messages *... and so on* ## Action Setup ### Get Threats **Note**: The input parameter `Filter` is an OData based filter which only supports two values: attackType and attackedParty. - To filter threats to only those with extortion intent use `attackType+eq+'Extortion'` - To filter threats to only received by VIPs in your organization use `attackedParty+eq+'VIP'` See the following for more information: - [OData Based Filters](https://www.odata.org/documentation/) - [Abnormal Security Swagger API Documentation](https://app.swaggerhub.com/apis/abnormal-security/abx/1.4.0#/Threats/get_threats) ## Notes Product version tested against: 1.10.0 ## Additional Documentation - [Abnormal Security Connector Documentation](https://docs.swimlane.com/connectors/abnormal-security) - [Abnormal Security API Documentation](https://app.swaggerhub.com/apis/abnormal-security/abx/1.4.0#/Threats/get_threats) - [Abnormal Security Authentication Guide](https://docs.swimlane.com/authentication-guides/abnormal-security) # Configurations ## Abnormal Security HTTP Bearer Authentication Authenticates using bearer token. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token | The API Token | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Download a Message in EML Format Retrieve an email message in EML format from Abnormal Security using the specified message ID. ### Endpoint - **URL:** `/messages/{{message_id}}/download` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------------- | | `path_parameters.message_id` | number | Required | The ABX Message ID of a message. | ### Input Example `{"path_parameters":{"message_id":123}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | object | Attachments | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"file":{"file":"string","file_name":"Example Name"}}` ## Download the Attachment in an Email as a File Downloads a specified attachment from an email in Abnormal Security using the message ID and attachment name. ### Endpoint - **URL:** `/messages/{{message_id}}/attachment/{{attachment_name}}/download` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ------------------------------------------------------------------- | | `path_parameters.message_id` | number | Required | The ABX Message ID of a message. | | `path_parameters.attachment_name` | string | Required | The attachment name of an attachment belonging to an email message. | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | string | Optional | Returns test data if set to `True`. | ### Input Example `{"path_parameters":{"message_id":123,"attachment_name":"Example Name"},"headers":{"mock-data":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | object | Attachments | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"file":{"file":"string","file_name":"Example Name"}}` ## Campaign Details Retrieve detailed information about an Abuse Mailbox campaign by its unique ID in Abnormal Security. ### Endpoint - **URL:** `/v1/abusecampaigns/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------ | | `path_parameters.id` | string | Required | Parameters for the Campaign Details action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"path_parameters":{"id":"id"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `campaignId` | string | Unique identifier | | `firstReported` | string | Output field: firstReported | | `lastReported` | string | Output field: lastReported | | `messageId` | string | Unique identifier | | `subject` | string | Output field: subject | | `fromName` | string | Name of the resource | | `fromAddress` | string | Output field: fromAddress | | `recipientName` | string | Name of the resource | | `recipientAddress` | string | Output field: recipientAddress | | `judgementStatus` | string | Status value | | `overallStatus` | string | Status value | | `attackType` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"campaignId":"fff51768-c446-34e1-97a8-9802c29c3ebd","firstReported":"2020-11-11T13:11:40-08:00","lastR...` ## Abuse Campaigns List Retrieve a list of reported campaigns from the Abuse Mailbox in Abnormal Security. ### Endpoint - **URL:** `/v1/abusecampaigns` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.filter` | string | Optional | Parameters for the Abuse Campaigns List action | | `parameters.sender` | string | Optional | Parameters for the Abuse Campaigns List action | | `parameters.recipient` | string | Optional | Parameters for the Abuse Campaigns List action | | `parameters.subject` | string | Optional | Parameters for the Abuse Campaigns List action | | `parameters.reporter` | string | Optional | Parameters for the Abuse Campaigns List action | | `parameters.attackType` | string | Optional | Parameters for the Abuse Campaigns List action | | `parameters.threatType` | string | Optional | Parameters for the Abuse Campaigns List action | | `parameters.pageSize` | number | Optional | Parameters for the Abuse Campaigns List action | | `parameters.pageNumber` | number | Optional | Parameters for the Abuse Campaigns List action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"parameters":{"filter":"lastReportedTime gte 2020-01-01T00:00:00Z lte 2021-12-01T00:00:00Z","sender":"sender","recipient":"recipient","subject":"subject","reporter":"reporter","attackType":"attackType","threatType":"threatType","pageSize":100,"pageNumber":1},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `campaigns` | array | Output field: campaigns | | `campaigns.campaignID` | string | Unique identifier | | `pageNumber` | number | Output field: pageNumber | | `nextPageNumber` | number | Output field: nextPageNumber | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"campaigns":[{}],"pageNumber":1,"nextPageNumber":2}}` ## Get Attachment in an Email Message Retrieves the details of a specified attachment from an email message in Abnormal Security using the message ID and attachment name. ### Endpoint - **URL:** `/messages/{{message_id}}/attachment/{{attachment_name}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ------------------------------------------------------------------- | | `path_parameters.message_id` | number | Required | The ABX Message ID of a message. | | `path_parameters.attachment_name` | string | Required | The attachment name of an attachment belonging to an email message. | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | string | Optional | Returns test data if set to `True`. | ### Input Example `{"path_parameters":{"message_id":123,"attachment_name":"Example Name"},"headers":{"mock-data":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `attachmentName` | string | Name of the resource | | `type` | string | Type of the resource | | `details` | array | Output field: details | | `md5` | string | Output field: md5 | | `sha1` | string | Output field: sha1 | | `sha256` | string | Output field: sha256 | | `size` | string | Output field: size | | `createdOn` | string | Output field: createdOn | | `lastUpdated` | string | Output field: lastUpdated | | `url` | array | URL endpoint for the request | | `keyPhrases` | array | Output field: keyPhrases | ### Output Example `{"attachmentName":"Example Name","type":"string","details":["string"],"md5":"string","sha1":"string","sha256":"string","size":"string","createdOn":"string","lastUpdated":"string","url":["string"],"keyPhrases":["string"]}` ## Case Details Retrieve detailed case information from Abnormal Security using a specific case ID. ### Endpoint - **URL:** `/v1/cases/{{caseId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | -------------------------------------- | | `path_parameters.caseId` | string | Required | Parameters for the Case Details action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"path_parameters":{"caseId":"caseId"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `caseId` | string | Unique identifier | | `severity` | string | Output field: severity | | `affectedEmployee` | string | Output field: affectedEmployee | | `firstObserved` | string | Output field: firstObserved | | `threatIds` | array | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"caseId":"1234","severity":"Potential Account Takeover","affectedEmployee":"FirstName LastName","first...` ## Case Action Status Check the status of a specific action on a case using the case ID and action ID in Abnormal Security. ### Endpoint - **URL:** `/v1/cases/{{caseId}}/actions/{{actionId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | -------------------------------------------- | | `path_parameters.caseId` | string | Required | Parameters for the Case Action Status action | | `path_parameters.actionId` | string | Required | Parameters for the Case Action Status action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"path_parameters":{"caseId":"caseId","actionId":"actionId"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `description` | string | Output field: description | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"status":"acknowledged","description":"The request was completed successfully"}}` ## Case Analysis Retrieve a detailed analysis and timeline for a specific case in Abnormal Security using the unique case ID. ### Endpoint - **URL:** `/v1/cases/{{caseId}}/analysis` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------------------------------- | | `path_parameters.caseId` | string | Required | Parameters for the Case Analysis action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"path_parameters":{"caseId":"caseId"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `insights` | array | Output field: insights | | `insights.signal` | string | Output field: insights.signal | | `insights.description` | string | Output field: insights.description | | `eventTimeline` | array | Output field: eventTimeline | | `eventTimeline.event_timestamp` | string | Output field: eventTimeline.event\_timestamp | | `eventTimeline.category` | string | Output field: eventTimeline.category | | `eventTimeline.title` | string | Output field: eventTimeline.title | | `eventTimeline.field_labels` | object | Output field: eventTimeline.field\_labels | | `eventTimeline.ip_address` | string | Output field: eventTimeline.ip\_address | | `eventTimeline.location` | object | Output field: eventTimeline.location | | `eventTimeline.location.city` | string | Output field: eventTimeline.location.city | | `eventTimeline.location.state` | string | Output field: eventTimeline.location.state | | `eventTimeline.location.country` | string | Output field: eventTimeline.location.country | | `eventTimeline.prev_location` | object | Output field: eventTimeline.prev\_location | | `eventTimeline.prev_location.city` | string | Output field: eventTimeline.prev\_location.city | | `eventTimeline.prev_location.state` | string | Output field: eventTimeline.prev\_location.state | | `eventTimeline.prev_location.country` | string | Output field: eventTimeline.prev\_location.country | | `eventTimeline.description` | string | Output field: eventTimeline.description | | `eventTimeline.isp` | string | Output field: eventTimeline.isp | | `eventTimeline.browser` | string | Output field: eventTimeline.browser | | `eventTimeline.operating_system` | string | Output field: eventTimeline.operating\_system | | `eventTimeline.device_trust_type` | string | Type of the resource | | `eventTimeline.protocol` | string | Output field: eventTimeline.protocol | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"insights":[{}],"eventTimeline":[{"event_timestamp":"2020-05-19T17:47:30Z","category":"Risk Event","ti...` ## Retrieve Cases Obtain an overview of detected security incidents by listing cases identified by Abnormal Security. ### Endpoint - **URL:** `/v1/cases` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.filter` | string | Optional | Parameters for the Retrieve Cases action | | `parameters.pageSize` | number | Optional | Parameters for the Retrieve Cases action | | `parameters.pageNumber` | number | Optional | Parameters for the Retrieve Cases action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"parameters":{"filter":"lastModifiedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","pageSize":100,"pageNumber":1},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `cases` | array | Output field: cases | | `cases.caseId` | string | Unique identifier | | `cases.severity` | string | Output field: cases.severity | | `pageNumber` | number | Output field: pageNumber | | `nextPageNumber` | number | Output field: nextPageNumber | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"cases":[{}],"pageNumber":1,"nextPageNumber":2}}` ## Get Details of the Remediation History Retrieve the remediation history details for a specific threat log message using its message ID in Abnormal Security. ### Endpoint - **URL:** `/messages/{{message_id}}/remediation_history` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------------- | | `path_parameters.message_id` | number | Required | The ABX Message ID of a message. | ### Input Example `{"path_parameters":{"message_id":123}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `remediation_history` | string | Output field: remediation\_history | | `folder_locations` | array | Output field: folder\_locations | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"remediation_history":"\"Auto-Remediated\": \"2023-04-11T20:54:56.244716+00:00\"","folder_locations":["Junk"]}}` ## Detection 360 Reports Retrieve Missed Attack or False Positive reports from Abnormal Security's Detection 360° by specifying the inquiry type. ### Endpoint - **URL:** `/v1/detection360/reports` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.inquiry_type` | string | Required | Specifies the type of inquiry for the report. Available values are MISSED\_ATTACK and FALSE\_POSITIVE. | | `parameters.start` | string | Optional | Parameters for the Detection 360 Reports action | | `parameters.end` | string | Optional | Parameters for the Detection 360 Reports action | | `parameters.status` | string | Optional | Defines the current status of the detection report. Available values are UNREVIEWED, CONTAINING\_ATTACK, IMPROVING\_PLATFORM, RESOLVED, and CORRECTING\_JUDGEMENT. | ### Input Example `{"parameters":{"inquiry_type":"MISSED_ATTACK","start":"2022-01-01T00:00:00Z","end":"2022-01-07T23:59:59Z","status":"UNREVIEWED","reporter":"reporter","attackType":"attackType","threatType":"threatType","pageSize":100,"pageNumber":1}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":[{"id":0,"inquiry_type":"MISSED_ATTACK","messages":{},"report":{},"status":"UNREVIEWED","submission_dat...` ## Employee Information Retrieve detailed information for an employee by using their email address as a unique identifier in Abnormal Security. ### Endpoint - **URL:** `/v1/employee/{{emailAddress}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ---------------------------------------------- | | `path_parameters.emailAddress` | string | Required | Parameters for the Employee Information action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"path_parameters":{"emailAddress":"emailAddress"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `email` | string | Output field: email | | `title` | string | Output field: title | | `manager` | string | Output field: manager | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"name":"Tom","email":"example@example.com","title":"General Manager","manager":"manager_email@example....` ## Employee Genome Analysis Retrieve identity analysis data for a specified employee from Abnormal Security using their email address. ### Endpoint - **URL:** `/v1/employee/{{emailAddress}}/identity` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | -------------------------------------------------- | | `path_parameters.emailAddress` | string | Required | Parameters for the Employee Genome Analysis action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"path_parameters":{"emailAddress":"emailAddress"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.key` | string | Response data | | `data.name` | string | Response data | | `data.description` | string | Response data | | `data.values` | array | Response data | | `data.values.value` | string | Response data | | `data.values.percentage` | number | Response data | | `data.values.total_count` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"data":[{}]}}` ## Non-analyzed Messages Retrieve messages from the Abuse Mailbox in Abnormal Security that are pending analysis. ### Endpoint - **URL:** `/v1/abuse_mailbox/not_analyzed` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ----------------------------------------------- | | `parameters.start` | string | Optional | Parameters for the Non-analyzed Messages action | | `parameters.end` | string | Optional | Parameters for the Non-analyzed Messages action | ### Input Example `{"parameters":{"start":"2022-01-01T00:00:00Z","end":"2022-01-01T00:00:00Z"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | object | Result of the operation | | `results.abx_message_id` | number | Unique identifier | | `results.recipient` | object | Result of the operation | | `results.recipient.name` | string | Name of the resource | | `results.recipient.email` | string | Result of the operation | | `results.reported_datetime` | string | Result of the operation | | `results.reporter` | object | Result of the operation | | `results.reporter.name` | string | Name of the resource | | `results.reporter.email` | string | Result of the operation | | `results.subject` | string | Result of the operation | | `results.not_analyzed_reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"results":{"abx_message_id":0,"recipient":{},"reported_datetime":"2024-05-17T06:19:57.145Z","reporter"...` ## Threat Details Retrieve detailed information for a specified threat in Abnormal Security using the unique threat ID provided. ### Endpoint - **URL:** `/v1/threats/{{threatId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.pageSize` | number | Optional | Parameters for the Threat Details action | | `parameters.pageNumber` | number | Optional | Parameters for the Threat Details action | | `path_parameters.threatId` | string | Required | Parameters for the Threat Details action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"parameters":{"pageSize":100,"pageNumber":1},"path_parameters":{"threatId":"threatId"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `threatId` | string | Unique identifier | | `messages` | array | Response message | | `messages.threatId` | string | Unique identifier | | `messages.abxMessageId` | number | Unique identifier | | `messages.abxPortalUrl` | string | URL endpoint for the request | | `messages.subject` | string | Response message | | `messages.fromAddress` | string | Response message | | `messages.fromName` | string | Name of the resource | | `messages.senderDomain` | string | Response message | | `messages.toAddresses` | string | Response message | | `messages.recipientAddress` | string | Response message | | `messages.receivedTime` | string | Response message | | `messages.sentTime` | string | Response message | | `messages.internetMessageId` | string | Unique identifier | | `messages.remediationStatus` | string | Status value | | `messages.attackType` | string | Type of the resource | | `messages.attackStrategy` | string | Response message | | `messages.returnPath` | string | Response message | | `messages.replyToEmails` | array | Response message | | `messages.ccEmails` | array | Response message | | `messages.senderIpAddress` | string | Response message | | `messages.impersonatedParty` | string | Response message | | `messages.attackVector` | string | Response message | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"threatId":"184712ab-6d8b-47b3-89d3-a314efef79e2","messages":[{}],"pageNumber":1,"nextPageNumber":2}}` ## Threat Action Status Check the status of a requested action on a threat within Abnormal Security using threatId and actionId. ### Endpoint - **URL:** `/v1/threats/{{threatId}}/actions/{{actionId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------------- | | `path_parameters.threatId` | string | Required | Parameters for the Threat Action Status action | | `path_parameters.actionId` | string | Required | Parameters for the Threat Action Status action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"path_parameters":{"threatId":"threatId","actionId":"actionId"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `description` | string | Output field: description | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"status":"acknowledged","description":"The request was completed successfully"}}` ## Threat Attachment Details Retrieve detailed attachment information for a given threat ID in Abnormal Security. ### Endpoint - **URL:** `/v1/threats/{{threatId}}/attachments` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------------------------------------------- | | `path_parameters.threatId` | string | Required | Parameters for the Threat Attachment Details action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"path_parameters":{"threatId":"threatId"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `threats` | array | Output field: threats | | `threats.abxMessageId` | number | Unique identifier | | `threats.attachmentName` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"threats":[{}]}}` ## Threat Link Info Retrieve detailed link information for a given threat ID from Abnormal Security, requiring the threatId as a path parameter. ### Endpoint - **URL:** `/v1/threats/{{threatId}}/links` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------ | | `path_parameters.threatId` | string | Required | Parameters for the Threat Link Info action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"path_parameters":{"threatId":"threatId"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | --------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `threats` | array | Output field: threats | | `threats.abxMessageId` | number | Unique identifier | | `threats.domainLink` | string | Output field: threats.domainLink | | `threats.linkType` | string | Type of the resource | | `threats.source` | string | Output field: threats.source | | `threats.displayText` | string | Output field: threats.displayText | | `threats.linkUrl` | string | URL endpoint for the request | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"threats":[{}]}}` ## Threat Retrieval Obtain a detailed list of threats identified by Abnormal Security, providing insights into potential security incidents. ### Endpoint - **URL:** `/v1/threats` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ------------------------------------------ | | `parameters.filter` | string | Optional | Parameters for the Threat Retrieval action | | `parameters.sender` | string | Optional | Parameters for the Threat Retrieval action | | `parameters.source` | string | Optional | Parameters for the Threat Retrieval action | | `parameters.recipient` | string | Optional | Parameters for the Threat Retrieval action | | `parameters.subject` | string | Optional | Parameters for the Threat Retrieval action | | `parameters.topic` | string | Optional | Parameters for the Threat Retrieval action | | `parameters.attackStrategy` | string | Optional | Parameters for the Threat Retrieval action | | `parameters.impersonatedParty` | string | Optional | Parameters for the Threat Retrieval action | | `parameters.attackType` | string | Optional | Parameters for the Threat Retrieval action | | `parameters.threatType` | string | Optional | Parameters for the Threat Retrieval action | | `parameters.pageSize` | number | Optional | Parameters for the Threat Retrieval action | | `parameters.pageNumber` | number | Optional | Parameters for the Threat Retrieval action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"parameters":{"filter":"receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","sender":"sender","source":"source","recipient":"recipient","subject":"subject","topic":"topic","attackStrategy":"attackStrategy","impersonatedParty":"impersonatedParty","attackType":"attackType","threatType":"threatType","pageSize":100,"pageNumber":1},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `threats` | array | Output field: threats | | `threats.threatId` | string | Unique identifier | | `pageNumber` | number | Output field: pageNumber | | `nextPageNumber` | number | Output field: nextPageNumber | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"threats":[{}],"pageNumber":1,"nextPageNumber":2}}` ## Vendor Details Retrieve details for a specified vendor domain from Abnormal Security, requiring the vendorDomain as a path parameter. ### Endpoint - **URL:** `/v1/vendors/{{vendorDomain}}/details` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ---------------------------------------- | | `path_parameters.vendorDomain` | string | Required | Parameters for the Vendor Details action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"path_parameters":{"vendorDomain":"vendorDomain"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `vendorDomain` | string | Output field: vendorDomain | | `riskLevel` | string | Output field: riskLevel | | `vendorContacts` | array | Output field: vendorContacts | | `companyContacts` | array | Output field: companyContacts | | `vendorCountries` | array | Output field: vendorCountries | | `analysis` | array | Output field: analysis | | `vendorIpAddress` | array | Output field: vendorIpAddress | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"vendorDomain":"vendor.com","riskLevel":"High","vendorContacts":["alice@vendor.com"],"companyContacts"...` ## Vendor Activity Retrieve interaction activity for a specified vendor domain in Abnormal Security, requiring the vendorDomain path parameter. ### Endpoint - **URL:** `/v1/vendors/{{vendorDomain}}/activity` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ----------------------------------------- | | `path_parameters.vendorDomain` | string | Required | Parameters for the Vendor Activity action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"path_parameters":{"vendorDomain":"vendorDomain"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `eventTimeline` | array | Output field: eventTimeline | | `eventTimeline.eventTimestamp` | string | Output field: eventTimeline.eventTimestamp | | `eventTimeline.eventType` | string | Type of the resource | | `eventTimeline.suspiciousDomain` | string | Output field: eventTimeline.suspiciousDomain | | `eventTimeline.domainIp` | string | Output field: eventTimeline.domainIp | | `eventTimeline.ipGeolocation` | string | Output field: eventTimeline.ipGeolocation | | `eventTimeline.attackGoal` | string | Output field: eventTimeline.attackGoal | | `eventTimeline.actionTaken` | string | Output field: eventTimeline.actionTaken | | `eventTimeline.hasEngagement` | boolean | Output field: eventTimeline.hasEngagement | | `eventTimeline.recipient` | string | Output field: eventTimeline.recipient | | `eventTimeline.threatId` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"eventTimeline":[{}]}}` ## Vendor Case Details Retrieve detailed information for a specific vendor case in Abnormal Security using the unique case ID. ### Endpoint - **URL:** `/v1/vendor-cases/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Vendor Case Details action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"path_parameters":{"id":"id"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | --------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `vendorCaseId` | number | Unique identifier | | `firstObservedTime` | string | Time value | | `lastModifiedTime` | string | Time value | | `vendorDomain` | string | Output field: vendorDomain | | `insights` | array | Output field: insights | | `insights.highlight` | string | Output field: insights.highlight | | `insights.description` | string | Output field: insights.description | | `timeline` | array | Output field: timeline | | `timeline.eventTimestamp` | string | Output field: timeline.eventTimestamp | | `timeline.senderAddress` | string | Output field: timeline.senderAddress | | `timeline.recipientAddress` | string | Output field: timeline.recipientAddress | | `timeline.subject` | string | Output field: timeline.subject | | `timeline.markedAs` | string | Output field: timeline.markedAs | | `timeline.threatId` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 22:40:36 GMT","Content-Type":"application/json","Content-Length":"1757","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"3aa7103c-84d3-474a-97dd-64b9870d59d6","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"vendorCaseId":0,"firstObservedTime":"2020-06-09T17:42:59Z","lastModifiedTime":"2020-06-09T17:42:59Z"...` ## Vendor Cases List Retrieve an overview of potential security incidents by listing vendor cases from Abnormal Security. ### Endpoint - **URL:** `/v1/vendor-cases` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------- | | `parameters.filter` | string | Optional | Parameters for the Vendor Cases List action | | `parameters.pageSize` | number | Optional | Parameters for the Vendor Cases List action | | `parameters.pageNumber` | number | Optional | Parameters for the Vendor Cases List action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"parameters":{"filter":"firstObservedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z","pageSize":100,"pageNumber":1},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `vendorCases` | array | Output field: vendorCases | | `vendorCases.vendorCaseId` | number | Unique identifier | | `pageNumber` | number | Output field: pageNumber | | `nextPageNumber` | number | Output field: nextPageNumber | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 22:40:35 GMT","Content-Type":"application/json","Content-Length":"109","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"9c0e0956-c50b-4c78-bd66-cb4b522d5fd6","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"vendorCases":[{}],"pageNumber":1,"nextPageNumber":2}}` ## List Vendors Retrieve a list of vendors your organization has interacted with via Abnormal Security. ### Endpoint - **URL:** `/v1/vendors` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | -------------------------------------- | | `parameters.pageSize` | number | Optional | Parameters for the List Vendors action | | `parameters.pageNumber` | number | Optional | Parameters for the List Vendors action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | ### Input Example `{"parameters":{"pageSize":100,"pageNumber":1},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `vendors` | array | Output field: vendors | | `vendors.vendorDomain` | string | Output field: vendors.vendorDomain | | `pageNumber` | number | Output field: pageNumber | | `nextPageNumber` | number | Output field: nextPageNumber | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"vendors":[{}],"pageNumber":1,"nextPageNumber":2}}` ## Case Management Update or retrieve details for a specific Abnormal Security case using the provided case ID. ### Endpoint - **URL:** `/v1/cases/{{caseId}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ----------------------------------------- | | `path_parameters.caseId` | string | Required | Parameters for the Case Management action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | | `action` | string | Optional | Parameter for Case Management | ### Input Example `{"json_body":{"action":"action_required"},"path_parameters":{"caseId":"caseId"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `action` | string | Output field: action | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"action":"action_required"}}` ## Threat Management Manage a specific threat in Abnormal Security by utilizing the provided threatId. ### Endpoint - **URL:** `/v1/threats/{{threatId}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.threatId` | string | Required | Parameters for the Threat Management action | | `headers` | object | Optional | HTTP headers for the request | | `headers.mock-data` | boolean | Optional | Response data | | `action` | string | Optional | Parameter for Threat Management | ### Input Example `{"json_body":{"action":"remediate"},"path_parameters":{"threatId":"threatId"},"headers":{"mock-data":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `actionId` | string | Unique identifier | | `statusUrl` | string | URL endpoint for the request | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{"actionId":"a33a212a-89ff-461f-be34-ea52aff44a73","statusUrl":"https://api.abnormalplatform.com/v1/thr...` ## Report Misjudgement Report a missed attack or false positive to Abnormal Security, enhancing future detection accuracy. A JSON body input is required. ### Endpoint - **URL:** `/v1/detection360/reports` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------- | | `report_type` | string | Optional | Type of the resource | | `received_date` | string | Optional | Date value | | `description` | string | Optional | Parameter for Report Misjudgement | | `portal_link` | string | Optional | Parameter for Report Misjudgement | ### Input Example `{"json_body":{"report_type":"false-positive","received_date":"2020/02/01","description":"Alice reported this email was missing from their inbox.","portal_link":"https://portal.abnormalsecurity.com/home/threat-center/remediation-history/1234567890"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 06 May 2024 20:11:44 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Server":"nginx","Vary":"Accept","Allow":"GET, OPTIONS","X-Abnormal-Trace-Id":"b1667e55-51de-4e6c-9a36-85ba4184dea3","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Referrer-Policy":"same-origin"},"reason":"OK","json_body":{}}` # Response Headers | **Header** | **Description** | **Example** | | ---------------------- | -------------------------------------------------------- | ------------------------------------ | | Allow | HTTP response header: Allow | GET, OPTIONS | | Connection | HTTP response header: Connection | keep-alive | | Content-Length | The length of the response body in bytes | 144 | | content-type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT | | Referrer-Policy | HTTP response header: Referrer-Policy | same-origin | | Server | Information about the software used by the origin server | nginx | | Vary | HTTP response header: Vary | Accept | | X-Abnormal-Trace-Id | HTTP response header: X-Abnormal-Trace-Id | 9c0e0956-c50b-4c78-bd66-cb4b522d5fd6 | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Frame-Options | HTTP response header: X-Frame-Options | DENY |